1 his !<sima o: doi^Ls replaces af. pnoi w.sk o » * i\ 1 v „ o „ 



: -.eci-wh \:VJO;\kv) \ rKlboJ to: ?oa.-i;^c sue: ^iOiis^;- of:K iX'M- ^u:kx 

(.o^nupu-jn-iiis o^ i asea network betvcei; a ^e^cied ^c-x-.. 1 - a;:*: a nbrai-u s a <a 
a i\.i> :jii\'s. b.;^v. ap.-n d^a;U t^or ^[vr-cve, s:v..Ux1u\.v 

^ < ^ ^ v„ s ^ i. 1 . f Ml J! 



peabrraanti ai baM >jnc s\riMical a^aKsis NefM'iieK 
aggregaie slot; and 

oi -rui-ag fv ns \]'- ; ^ ^s.ca sta; vicaj anab ^ a^ .a 



oi ,w*\ul a^ca^ 



\^ " hjcikv'S j ;c.":ot.s'0 of o\a ^ 1, wba.a - 5 a: ^ s m < \v ot ~ *e ae,c- 
nukajvn put ^ <.o:-:n.\.i;ns.; as.t ^f*U cisen; macs: nca'.c- :-k> v/a\"aa \o>^os. 



5 Oj^uiaH Uvmcnv^i oUUim L iurtha spdud-ng gOvTahng ar a\e;a 



- a *n^inalt H>. :rUbod of a ara; !, k U?iSi'E -5KlLu!f>' ^.kvt'.nu me a^pvg'Uum 
^U'\v v <> '.a-.u' acini's 



5. (Original) The method of claim i, wherein .the aggregation method includes 
iggteevvu b\ i — d-v \.wJ column dat \ \alue swh ;co<vJ r. :W: vO^or 

6 : 0. (Canceled) 

] 1 . (Currently Amended) A system for real-time nieasurernent of the performance of 
client machines, based sapors actual user experience, including: 

N . K S t i 1 ' N v 1 ' t v N- 

network of actual user access to the selected server; 

means for filtering out selected records from the server iog^ wherein ihejn^sfor 

> .NN S ! . 5 * 1- V * > >N ^N O ' 

of aggregate slots, each having at least one time -bin which represents an interval of time, based 
on an aggregation rneinoo; 

means tor perfornvng at least one statist'cat anahs^ ;>i each, time hetng oi'eaen 
aggregate slot; and 

V. n 'ti'( r.si .s^s,.,^ 1 i"U i .p - n , a > . n.V>^ 

access to actual server usage by users. 

0 ^ ' N >l 1 -NN U C i N < N V 4 \ 

is part of a communication path connecting one of the client machines to the selected server, 

1 3. (Original) The system of claim. 1 I , further including means for generating m 
event notification if a selected statistical analysis value is abnormal. 

14. (Ori ginal) The system of claim ! 1 , further including means lor selecting the 
aggregation method from a set of aggregation methods. 



1 5, (Original.) The system of claim 1 1 , wherein the aggre*/at.or memee *sk *uev 
aggregation by log-file record column data value for each record Iron's trie server log. 



16-20. (Canceled) 

2 ] . (Currently Amended) A computer program, stored on a tangible computer- 
readable medium, for real-time measurement of the performance of communications on a large 
area network between a selected server and a plurality of users at client machines, based upon 
actual user experience, the computer program comprising instructions for causing a computer 
system to: 

access a server leg having records of routing through nodes of the network of 
ac'm i ...v .tv.c-^s ^ -be sck\ie<. ^\ck 

mm; om v\e.!ee ;^o;ds :mm no e=< e- leg. vOuaem fm veleca-d ioco'-is 

1V „ a^ w\ ^< c t <o*. tr'v ^ , t <• c n a - ea < no\ . ^ 

having at least one time bin, based on an aggregation method; 

v - t ! < i. 1 ! s v 5- 1 e u , i ei on ^ • > " v 

ve \ ^ o e ~ v a v *eg i<- ^m m 

o o. ^rJo- of e i>:\i anahsis an maicuuen of. ;i m,d v, r.cr 



!y Presented) 'The computer program of claim 2 1, wherein at least one o 



2? < • ^ cjnal) 1 he compiler pmgram <n°ekmr 2 i . lurL.'e; mcmdmg mstrueimns foi 
ce ntng uV w<«i'K'uki sxstem to generate an event .notification if a selected statistical analysis 
value ss abnormal. 



24. (Omtmain he eonoufer program of eLnn 21, junnei mchsd'ng sr-m-uaioo-? for 
causing the computer system k> select the aggregation method from a set of aggregation, 
methods. 

25, (Original) The computer program of claim 2 ! , wherein the aggregation method 
includes aggregation by log-file record column data for .each record from the server log. 

26 - 30. (Canceled) 

determines time for specified user access relative to a specified interval and sorts said user 
access according to a number of times that the application exceeds said interval 

; ? x l'iv%uv^\ fu-vntid' \ n-ietf-fai a-- in d.mr 1 , ^ho*em sate ^eise- loe «uc udc- 
w.o /-amp .u: . :e-!.. ^ heu -.^erd >\aa \'u:;-J, . c:er: IP add-^v *m:c u,\e-~. 'o ^espUe 
; m - - s or ee. ' v <*ar-i u-s <v 

^ ?- N ew< ; ds ihesemed! \ veih.K? 'is -u e aau "2, ^acsesr uui v..i\,.; jog >s forrni 
" k . v i ^ \ i ^ " ~s i hi » u * ! * ' l ^ d i <~ s 

u> said performing. 

v , ^ '\^, .J \ . )' > < < ,! ^ >0 J., 'w \ 

: dc;e^e:o::;; ^.ir^'luc h<au^ ir--m dv IP addr^s. ..-J -ggrepaonc ij* add-i -'se^ 
*vm<y- < l specified relationship with a specified geographical location. 

>n , ^ "oUi'i , t Ja» i - v v ^ " o - 

s ' < 0 - „ \ v . > v!„ . 1 d. C . i' 10 e^ < , v !t - <. e 

„ , ' v. 0 \ V s o e - ^ " ^ f i „ ^ 

imonnaUer, ; ^ compute? Kte dvYsrstv. fancier faK, and one; 'factkvs 



40. (Previously Presented) A system as in claim 1 1 , wherein said server log includes 
i , us , <s >. ^ 0' .k< i \ ^ > ' t.d j v <v. " ^ <~ e^ l ^c> > v ^pe\ 

* -l !-s'0 1 ^ . . U ' ^ i v n 

by added new data as entries to the server log, and said server log is closed to -further data entry 
prior to said performing. 

1^ tl'scs sou.-h Ps.'fecnh.-d' v "vwteui as m cUim 40 v< he: em ^Ki .ivces^fY me r.ss 
converts the IP address into a geographical location, and aggregates IP addresses having a 
specified relationship with a. specified geographical location. 

s '-u>\ h.'i-ds ;N CM.rie>:^ A .-e^m is <k u- ^:asm -IK v svo^ -\;-J Mao ^cd a u.'a^^ - 
a- . ^>os^t.< i-S ■ i'U Vro.auc :c.aiv.d roe ^uvmosv ae, :msv a -omv^h-cJ ;>ui; ^ r ! a t Lec 

44. (Previously Presented) A system as in claim 40. wherein said statistical analysis- i 
. s ^ m\<* , , „ A . 'a\.>-od vi\ n ^ ot*i C 00 woiK ip\- '<)- 1 ^> Co 



~ > *' *.s»oa-i\ F'ocnted) A system as in claim I L further comprising a 
\vnj;mu»ication , outing part, determining a new path based on said results of said statistical 

4i, {P-ev-i^h i'joscntcdi He .omputer ps>-gram a\ a- >J ma ? 1 . -a-n^urs said 
msn^u.-ns U : aece°o tbe server .oe c-^npr-^es r.i.Oiff..ehoik- to .icvuSo a se^c k<y "h.w a-e^ua^ 
time <nli>~matio5* ah-ui iceofos. dr v nt V iddre^s, o'rne taken to compete a u-msnnMh-n, .aid a 
size or the transmission, 

m\is\ osn>u> n- >igpogite mebe'v nvtrceOorK u> cum en ue IV adar-^s mk> snfonmU'.osi 
Vu' ' c <,v '< v. , \! L> a a* ate l c N v i.oia^^at k 
>u- ap m . t>x ,, ^ 

48. (Previously Presented) The comouter p oj. *\ " s v.a. •> t \Wc < »* 
instructions to perform a statistical analysis petv * t ^t,. umk * »r \ss\ no. N ^ st 

geographical location of the client. 

40. (Previously Presented) The e» wi un l n\ , v j ( ^ i- >i 
instn^ibwis ! o rvifoim a <?\msii.,.vi1 aoalws pe-rorm :he a «iaKs«e;« rr;';v^' ;»^cnn»>- - 'inin- 
nawi.seJ liunngj oe?\uul> application, 

50. i^ 1 ^ P os 1 a t h^ < oiO H Vi *i N r » * v » 5 u 
v;dv!.:u'...;l n ^-cc'ioiv 10 ,;ct.Tniaie a :k i,I ' > --i * , - < - <■ ^ ! v v 

51. i Previously Presemed) 1 he method of claim 34, w heroin delermbiim 
geographical or source information for each record includes; 

doVnrc ; oas<u\^o eonipnsine ioigc .awa nen-^k udvhv^ b'-vks h n ; ?ie y^.L-Mplueal or 
source information; 

, i . » * uO" n i 0 < 5 , ?*\a i. U,k, <^ ! V d > o . < 



Client Ret: P7M5 

associating with each record the geographical or source intbrmaaoa from an address 
block matching the address field of the record. 

Held in each record to the address blocks in the database includes: 

defining an array of binary trees for Ihe address blocks in the database, each address 
block within a binary tree within an array element being masked by a corresponding unique 
subnet mask value; 

selected array dement; 

comparing- each masked address field to an address field of the address blocks within the 
h;nr ;i \ live ^ ;he -e ecu.d -\rr^ viem-.-nr. 

otttputting selected fields of any matching address block; and 

otherwise continuing the step of comparing \uth a next selected army clement until i* 

match is found or ah array elements have been compared. 

dofeommng e\rt r><usme t aths i ; oni each, sekvkd suu 1 : hav-d <n? die rec<-'ds doei the 
server log; 

determm r : g j best pes ?>--nvnng exu route h^sed oil the si aisbcJ aiahs;> n.eord# from 
the server log; 

*-as\ i r \ 1 \ ;re ft,i,gor „i _o -mmrv 1* ci,~ v rb e-. v e • b v a. Pv 
dcviernvd b v< k\e\re ev, ^ute 

54. (Previously Presented) The system of claim 1 1 , further comprising: 
siKT-vs for determining geographical or <ouree mtbrmutvr. lor each icvoreb a\A 
ti - ^< , m-n netitod to v'ggtegaK .ec cav.d <v m^I 



Clse&tRef.: P7615 

55. (Previously Presented) The system of claim 54, wherein the means for 
determining geographical or source information for each record includes: 

J ;t.b.e<.- c.-nipn.Mi:.: .a^pe area iseou-k add;^ bVef- kou-t. ecoeumhic... >a .-.oar.c 
information; 

a comparison function for comparing an address tkk! m each record to the addicts blocks 
in the database; and 

information from an address block matching the address field of the record. 

56, {Previously Presented} The system of claim 55. wherein the comparison function 
includes: 

within a binary tree within an array dement being masked by a corresponding unique subnet 
mask value; 

means for masking each address field in each record by a unique subnet value 

corresponding to a selected array element; 

t.ii' V: c<a y ;<- ; ny each m.oUd addjess nek: t.> .m aeo:c^ :Ud ■■{ fot- jddec^ bock- 

within the binary tree of the selected array element: 

mo.c^ inputting sekated tVaK oi <m\ matchmg adcte-- Hoek .dih 1 

t-o.-ios ic \x sse ..^sam jam £U Mcr <.ompa; inc. ^ uh ".cs' - /:ccU.c v:.o ciemcn: 

until match is found oral! array elements have been compared. 

Si ! n v > i i s !(.' ' I 1 ! ! ^ I 5 

means for determi ning exit routing paths for each selected server based on the records 
from the server log; 

means for determining a best performing exit route based on the statistical analysis of 
records tram the server log; 

means tor biasing incoming and t»-'u» i 0 vomr.ur «. » ^- ^ . vscu .c > *v -c se< c 
>>e .<v .L e* - * wc ies: res ^ J .cite 



Semico. : 09/47 1.964 
Filed : Dei*«jbsr23. 



58. (Previously Presented) The computer program of claim 2 1 , further including 
instructions tot causing the computer system to: 

determine geographical or source information for each record; and 

select the aggregation method to aggregate records based on such geographical or source 



60. (Previously Presented) The computer program of claim 59, wherein the 



